CVE-2025-41236

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-412379.3VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-CVE-2025-412389.3VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an CVE-2025-412397.1VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised mem CVE-2025-41249.8Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitra CVE-2025-4124010.0Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server d CVE-2025-412414.4VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perf CVE-2025-412425.9Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. CVE-2025-4124310.0Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vuln CVE-2025-412447.8VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative CVE-2025-412454.9VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operat CVE-2025-412467.6VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor CVE-2025-412487.5The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameter